alert tcp any any -> $HOME_NET 80 (msg:"Detected XSS Reflected (PHP_SELF) Attack"; flow:to_server,established; content:"<script"; http_uri; classtype:web-application-attack; sid:1000002; rev:1;)